"a > 1000% spike in 404s" overloaded your servers? Such are your generation times? Can I bring the entire NPM ecosystem down from my ADSL line using some silly threaded code to make requests to randomly named packages?
You're right that our handling of 404s was naive, and that's definitely something we'll be improving as a result of what we've learned from this incident.